import { isObject } from "@scalar/helpers/object/is-object";
import { objectEntries } from "@scalar/helpers/object/object-entries";
//#region src/v2/blocks/scalar-auth-selector-block/helpers/extract-security-scheme-secrets.ts
/**
* Maps x-scalar-secret fields to their corresponding input field names.
* This allows us to fall back to config values when auth store secrets are not available.
*/
var SECRET_TO_INPUT_FIELD_MAP = {
	"x-scalar-secret-client-id": "x-scalar-client-id",
	"x-scalar-secret-client-secret": "clientSecret",
	"x-scalar-secret-password": "password",
	"x-scalar-secret-redirect-uri": "x-scalar-redirect-uri",
	"x-scalar-secret-token": "token",
	"x-scalar-secret-username": "username",
	"x-scalar-secret-auth-url": "authorizationUrl",
	"x-scalar-secret-token-url": "tokenUrl"
};
var mergeFlowSecrets = (properties, configSecrets, authStoreSecrets = {}) => Object.fromEntries(properties.map((property) => {
	return [property, authStoreSecrets[property] || configSecrets[property] || configSecrets[SECRET_TO_INPUT_FIELD_MAP[property]] || ""];
}));
var extractRefreshTokenSecret = (authStoreSecrets = {}) => {
	const refreshToken = authStoreSecrets["x-scalar-secret-refresh-token"];
	if (typeof refreshToken === "string") return { "x-scalar-secret-refresh-token": refreshToken };
	return {};
};
var extractCredentialsLocation = (configSecrets, authStoreSecrets = {}) => {
	const credentialsLocation = authStoreSecrets["x-scalar-credentials-location"] ?? configSecrets["x-scalar-credentials-location"];
	return credentialsLocation ? { "x-scalar-credentials-location": credentialsLocation } : {};
};
/**
* Extract flow secrets and selected scopes for OAuth-like flows.
* Reused by both oauth2 and openIdConnect security schemes.
*/
var extractOAuthFlowSecrets = (flows, storeSecrets) => {
	const selectedScopes = /* @__PURE__ */ new Set();
	return {
		flows: objectEntries(flows ?? {}).reduce((acc, [key, flow]) => {
			if (!isObject(flow)) return acc;
			const flowSelectedScopes = flow["selectedScopes"];
			if (Array.isArray(flowSelectedScopes)) flowSelectedScopes.forEach((scope) => typeof scope === "string" && selectedScopes.add(scope));
			if (key === "implicit") acc.implicit = {
				...flow,
				...mergeFlowSecrets([
					"x-scalar-secret-client-id",
					"x-scalar-secret-redirect-uri",
					"x-scalar-secret-token",
					"x-scalar-secret-auth-url"
				], flow, storeSecrets?.implicit),
				...extractRefreshTokenSecret(storeSecrets?.implicit)
			};
			if (key === "password") acc[key] = {
				...flow,
				...mergeFlowSecrets([
					"x-scalar-secret-client-id",
					"x-scalar-secret-client-secret",
					"x-scalar-secret-username",
					"x-scalar-secret-password",
					"x-scalar-secret-token",
					"x-scalar-secret-token-url"
				], flow, storeSecrets?.password),
				...extractCredentialsLocation(flow, storeSecrets?.password),
				...extractRefreshTokenSecret(storeSecrets?.password)
			};
			if (key === "clientCredentials") acc[key] = {
				...flow,
				...mergeFlowSecrets([
					"x-scalar-secret-client-id",
					"x-scalar-secret-client-secret",
					"x-scalar-secret-token",
					"x-scalar-secret-token-url"
				], flow, storeSecrets?.clientCredentials),
				...extractCredentialsLocation(flow, storeSecrets?.clientCredentials),
				...extractRefreshTokenSecret(storeSecrets?.clientCredentials)
			};
			if (key === "authorizationCode") acc[key] = {
				...flow,
				...mergeFlowSecrets([
					"x-scalar-secret-client-id",
					"x-scalar-secret-client-secret",
					"x-scalar-secret-redirect-uri",
					"x-scalar-secret-token",
					"x-scalar-secret-auth-url",
					"x-scalar-secret-token-url"
				], flow, storeSecrets?.authorizationCode),
				...extractCredentialsLocation(flow, storeSecrets?.authorizationCode),
				...extractRefreshTokenSecret(storeSecrets?.authorizationCode)
			};
			return acc;
		}, {}),
		selectedScopes: Array.from(selectedScopes)
	};
};
/** Extract the secrets from the config and the auth store */
var extractSecuritySchemeSecrets = (scheme, authStore, name, documentSlug) => {
	const secrets = authStore.getAuthSecrets(documentSlug, name);
	if (scheme.type === "apiKey") {
		const storeSecrets = secrets?.type === "apiKey" ? secrets : void 0;
		return {
			...scheme,
			"x-scalar-secret-token": storeSecrets?.["x-scalar-secret-token"] || scheme.value || ""
		};
	}
	if (scheme.type === "http") {
		const storeSecrets = secrets?.type === "http" ? secrets : void 0;
		return {
			...scheme,
			"x-scalar-secret-token": storeSecrets?.["x-scalar-secret-token"] || scheme.token || "",
			"x-scalar-secret-username": storeSecrets?.["x-scalar-secret-username"] || scheme.username || "",
			"x-scalar-secret-password": storeSecrets?.["x-scalar-secret-password"] || scheme.password || ""
		};
	}
	if (scheme.type === "oauth2") {
		const storeSecrets = secrets?.type === "oauth2" ? secrets : void 0;
		const extracted = extractOAuthFlowSecrets(scheme.flows, storeSecrets);
		const configuredDefaultScopes = Array.isArray(scheme["x-default-scopes"]) ? scheme["x-default-scopes"].filter((scope) => typeof scope === "string") : [];
		const mergedDefaultScopes = Array.from(new Set([...configuredDefaultScopes, ...extracted.selectedScopes]));
		return {
			...scheme,
			flows: extracted.flows,
			"x-default-scopes": mergedDefaultScopes
		};
	}
	if (scheme.type === "openIdConnect") {
		const storeSecrets = secrets?.type === "openIdConnect" ? secrets : void 0;
		const extracted = extractOAuthFlowSecrets({
			implicit: storeSecrets?.implicit,
			password: storeSecrets?.password,
			clientCredentials: storeSecrets?.clientCredentials,
			authorizationCode: storeSecrets?.authorizationCode
		}, storeSecrets);
		return {
			...scheme,
			...objectEntries(extracted.flows).length ? { flows: extracted.flows } : {}
		};
	}
	return scheme;
};
//#endregion
export { extractSecuritySchemeSecrets };

//# sourceMappingURL=extract-security-scheme-secrets.js.map